Wireshark-dev: Re: [Wireshark-dev] Question regarding the information provided by Wireshark in 
      
      
Andreina, i replied to your private mail, but i also reply to this for 
archiving purposes...
Andreina Toro wrote:
    Hi everyone, I have a question regarding the calculation of
    interarrival jitter and the information provided by Wireshark in the
    "RTP Stream Analysis Wndow" for each call.
I can see that Wireshark gives me in the 4th Row of the RTP Stream 
Analysis Wndow the Jitter for each packet of each call.
 
In the other hand I´ve read that:
 
"If Si is the RTP timestamp from packet i, and Ri is the time of arrival 
in RTP timestamp units for packet i, then for two packets i and j, D may 
be expressed as 
                                           
D(i,j)=(Rj-Ri)-(Sj-Si)=(Rj-Sj)-(Ri-Si)
The interarrival jitter is calculated continuously as each data packet i 
is received from source SSRC_n, using this difference D for that packet 
and the previous packet i-1 in order of arrival (not necessarily in 
sequence), according to the formula                                 
J=J+(|D(i-1,i)|-J)/16
Whenever a reception report is issued, the current value of J is sampled."
 
What I don´t have clear is what this Jitter in the 4th Row represents in 
the interarrival jitter calculation?
Well, it represents just that!
The value in 4th column *is* the value of J(i) according to the above 
formula (ref. RFC 3550), starting with J(0):=0 and Ri:=frame.time(i) and 
Si:=rtp.timestamp(i) in appropriate units (for conversion between units, 
the clock sample rate is used - for details see the code in rtp_analysis.c).
Can I calculate the jitter J, defined to be the mean deviation, with 
that data? I mean, can I use the values of the jitters of each 
packet given in that RTP Stream Analysis in every call and calculate the 
difference D??
                            D_m = \frac{1}{n} \sum_{i=1}^n \left| x_i -
    \overline{x} \right| 
What do you call "the jitter J"?
As said, the Jitter J(i) on a packet-by-packet basis is defined as above 
and viewed in Wireshark RTP analysis in the 4th column.
If you want to have *one* value of J for a whole communication, feel 
free the take the (arithmetic) mean over all J(i) (this is done and 
shown on the RTP streams window by stream btw.) or use some other 
mean/average.
I cannot tell you if one is more representative/common than another though.
best regards,
Lars Ruoff